{"id":"CVE-2026-61739","kind":"vulnerability","aliases":["CVE-2026-61739"],"related":[],"title":"SOCFortress CoPilot: forged token can suppress security detections platform-wide","description":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role and tenant authorization, and `POST /api/incidents/alerts/create/velo-sigma/exclusion` does not validate credentials. Its `return_username_for_logging` dependency in `backend/app/auth/utils.py` calls `decode_token`, which returns ordinary Invalid token or Expired signature strings on failure, and the dependency passes these strings through instead of rejecting the request. A Bearer header is required, but an arbitrary invalid, expired or forged value can create a suppression rule without a valid account. The collection GET at /create/velo-sigma/exclusion lists exclusions; the read, update and delete routes under `/create/velo-sigma/exclusion/{exclusion_id}`, and the `/velo-sigma/exclusion/{exclusion_id}/toggle` route, use `get_current_user` without role checks, permitting any authenticated `customer_user` to manage every exclusion. In `backend/app/incidents/services/velo_sigma.py`, `process_sigma_alert` calls `check_exclusions` and drops matching enabled alerts before incident creation. A null `customer_code` applies a rule across all tenants. Attackers can suppress detections platform-wide through channel, title or field matching, while low-privilege accounts can enumerate detection-tuning data and modify, disable or delete legitimate exclusions. This issue is fixed in version 0.1.77.","summary":"Before version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints accept invalid, expired or forged Bearer tokens, so an attacker can create suppression rules without an account. Those rules can silently drop matching security alerts across all tenants, and low-privilege users can read, change or delete existing exclusions.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","sigma","socfortress-copilot","velociraptor"],"not_affected_if":["version-0.1.77-or-later"],"how_to_check":"- Check the installed CoPilot version; affected builds are anything below `0.1.77`.\n- Look in `backend/app/auth/utils.py` for `return_username_for_logging` passing through `decode_token` error strings instead of rejecting the request.\n- Review existing Velociraptor Sigma exclusions for rules with a null `customer_code`, which apply across all tenants.","fix":"- SOCFortress CoPilot: upgrade to `0.1.77`","status":"open","published_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:21+00:00","updated_at":"2026-10-30T15:33:21+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-30T15:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- SOCFortress CoPilot: upgrade to `0.1.77`","reach":"network","title":"SOCFortress CoPilot: forged token can suppress security detections platform-wide","impact":"medium","summary":"Before version 0.1.77, SOCFortress CoPilot's Velociraptor Sigma exclusion endpoints accept invalid, expired or forged Bearer tokens, so an attacker can create suppression rules without an account. Those rules can silently drop matching security alerts across all tenants, and low-privilege users can read, change or delete existing exclusions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["socfortress-copilot","velociraptor","sigma","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker suppresses detections across all tenants and tampers with exclusions","analyst_note":"Confirm the exact Velociraptor Sigma feature gating and whether the bypass needs a deployed Velociraptor integration; check the NVD record for the CVSS vector.","how_to_check":"- Check the installed CoPilot version; affected builds are anything below `0.1.77`.\n- Look in `backend/app/auth/utils.py` for `return_username_for_logging` passing through `decode_token` error strings instead of rejecting the request.\n- Review existing Velociraptor Sigma exclusions for rules with a null `customer_code`, which apply across all tenants.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.1.77-or-later"],"who_is_affected":"Teams running SOCFortress CoPilot with the Velociraptor Sigma exclusion feature are exposed, since the flaw sits in the incident alert routes and the auth dependency they share. Anyone on `0.1.77` or later is not affected by this issue. Sources do not say whether the flaw depends on a specific deployment mode beyond the Velociraptor Sigma feature being present.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000818,"input_tokens":4567,"output_tokens":722,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61739':14A,17A '/api/incidents/alerts/create/velo-sigma/exclusion':112C '/create/velo-sigma/exclusion':177C,187C '/toggle':195C '/velo-sigma/exclusion':192C '0.1.77':29B,95C,276C 'accept':37B 'account':53B,172C,256C 'across':62B,236C 'alert':61B,217C,225C 'appli':233C 'arbitrari':158C 'attack':46B,239C 'authent':206C 'author':109C 'backend/app/auth/utils.py':124C 'backend/app/incidents/routes/incident_alert.py':104C 'backend/app/incidents/services/velo_sigma.py':214C 'bearer':42B,152C 'call':125C,218C 'chang':72B 'channel':247C 'check':203C,219C 'code':232C 'collect':174C 'copilot':2A,25B,31B,78C 'creat':48B,165C 'creation':228C 'credenti':116C 'current':199C 'custom':207C,231C 'cve':12A,15A 'data':262C 'decod':126C 'delet':74B,184C,267C 'depend':122C,141C 'detect':8A,242C,260C 'detection-tun':259C 'disabl':265C 'drop':58B,222C 'enabl':224C 'endpoint':36B,102C 'enumer':258C 'everi':211C 'exclus':35B,76B,100C,179C,188C,193C,212C,220C,269C 'exclusion-manag':99C 'exist':75B 'expir':39B,134C,160C 'failur':138C 'field':250C 'fix':273C 'focus':79C 'forg':3A,41B,162C 'get':175C,198C 'glass':86C 'header':153C 'host':21B 'id':189C,194C 'incid':227C 'instead':146C 'invalid':38B,131C,159C 'issu':271C 'legitim':268C 'list':178C 'log':121C 'low':67B,254C 'low-privileg':66B,253C 'manag':101C,210C 'match':59B,223C,251C 'modifi':264C 'need':92C 'null':230C 'omit':105C 'oper':91C 'ordinari':130C 'pane':84C 'pass':142C 'permit':204C 'platform':10A,244C 'platform-wid':9A,243C 'post':111C 'prior':93C 'privileg':68B,255C 'process':215C 'provid':81C 'read':71B,181C 'reject':148C 'request':150C 'requir':155C 'return':118C,129C 'role':106C,202C 'rout':185C,196C 'rule':50B,55B,168C,235C 'secur':7A,60B,90C 'self':20B 'self-host':19B 'sigma':22B,34B,98C,216C 'signatur':135C 'silent':57B 'singl':83C 'socfortress':1A,24B,30B,77C 'socfortress-copilot':23B 'string':136C,144C 'suppress':6A,49B,167C,241C 'tenant':64B,108C,238C 'titl':248C 'token':4A,43B,127C,132C 'tune':261C 'updat':182C 'use':197C 'user':69B,200C,208C 'usernam':119C 'valid':115C,171C 'valu':163C 'velociraptor':26B,33B,97C 'version':28B,275C 'wide':11A,245C 'without':51B,169C,201C","nicknames":[],"mitigations":[],"who_affected":"Teams running SOCFortress CoPilot with the Velociraptor Sigma exclusion feature are exposed, since the flaw sits in the incident alert routes and the auth dependency they share. Anyone on `0.1.77` or later is not affected by this issue. Sources do not say whether the flaw depends on a specific deployment mode beyond the Velociraptor Sigma feature being present.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61739","severity":null,"published_at":"2026-10-30T15:16:53+00:00","modified_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}